67bbd7501acba95a94a174e9207035d1deb292d2d1752cbc5073d06cc724d24a

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/05/2023, 20:31

Target

SecuriteInfo.com.Win64.DropperX-gen.15742.dll
Size

1.2MB
MD5

8f59ec5c7010d957b459dc097479fd8d
SHA1

1f88391816623d0d7c91769f968850656d183598
SHA256

67bbd7501acba95a94a174e9207035d1deb292d2d1752cbc5073d06cc724d24a
SHA512

f8cc12084c28c13e9ed7ad2cad5cd69714a6308da33bf690cf16fed089100838e752543a28d3a6f2bff7d5763cfd0d0303b8fe5eac797299aa1ffa84824d62cd
SSDEEP

24576:Lp2qJU4iIuB2cMh1Mgc17V/sCaGhRwQasBxUy0G4ITvVtQOZz0r/aahQIStkn:JmyD8R8QqKbQ8AmvKn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1372	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 836	1372	rundll32.exe	28
PID 1372 wrote to memory of 836	1372	rundll32.exe	28
PID 1372 wrote to memory of 836	1372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.DropperX-gen.15742.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1372 -s 84
  2⤵
  - Program crash
  PID:836